4 ms·

> it's just that with 51% of hashpower it becomes relatively cheap to perform such attack The qualitative difference is that with 51% of hashpower you can sust

> it's just that with 51% of hashpower it becomes relatively cheap to perform such attack The qualitative difference is that with 51% of hashpower you can sustain the attack indefinitely. Other miners might get the occasional block and temporarily take the lead but in the long run you'll always have the longest chain using only blocks you've mined yourself. With less than 50% there's a chance that you can revert a transaction temporarily by mining two consecutive blocks (one to omit the transaction and another to make your chain longer than the original) in less time than it takes the main network to reach the same block height, but the odds of maintaining the attack drop by at least half with each additional block. The main network will always win eventually. In any case no one controls anywhere close to 51% of the hashpower right now. There are pools which approach that size but they aren't monolithic entities; if the pool operators attempted to leverage their position as coordinators to carry out a sustained attack then miners would leave the pool.

Retric 7y ago
That assumes that every other miner all mines the old chain. If you and ‘dumb’ miners that just use the longest chain add up to 51% then luck is enough.
- nybble41 7y ago
  No, I was assuming that the other miners continue the longest chain, not the old chain. But they'll include the transaction(s) you were trying to suppress in their blocks; they're not on your side. Each time they mine a block you have to start the attack over again, and the odds are not in your favor. You control under half the hashpower and you need to stay at least one block ahead of the main network. It's not a race you can win in the long term, even assuming a certain amount of luck.
  - Retric 7y ago
    If those transactions are larger than the wallets remaining funds that can’t happen. Aka wallet A moves coins to wallet B on the old chain and moves all it’s funds into wallet C in the new chain. In that case the A>B transaction is invalid on the new chain.
    - nybble41 7y ago
      That isn't quite how Bitcoin works. Transactions use specific unspent prior transaction outputs (from the "UTxO" set) as inputs; there is no concept of "remaining funds". However, you're mostly right: if the attacker controls the private keys related to the original transaction then they can insert a conflicting transaction and make the original one permanently invalid on that chain. However, an attacker who does not have the private keys to sign a conflicting transaction cannot prevent the transaction from eventually being confirmed unless they control over 50% of the hashpower. If you're concerned that the person you're receiving funds from might be willing to attempt a double-spend then you should wait for a suitable number of confirmations before considering the funds successfully transferred. However, if they control over 50% of the hash rate then there is no suitable number of confirmations that would make the transfer safe.
keymone 7y ago
you're right, 51% represents a certain barrier when the attack becomes much more destructive, but it's still a spectrum. you can destroy faith in the system and value of bitcoin by performing multiple long reorgs with less than 51%.

Retric 7y ago

That assumes that every other miner all mines the old chain. If you and ‘dumb’ miners that just use the longest chain add up to 51% then luck is enough.

nybble41 7y ago
No, I was assuming that the other miners continue the longest chain, not the old chain. But they'll include the transaction(s) you were trying to suppress in their blocks; they're not on your side. Each time they mine a block you have to start the attack over again, and the odds are not in your favor. You control under half the hashpower and you need to stay at least one block ahead of the main network. It's not a race you can win in the long term, even assuming a certain amount of luck.
- Retric 7y ago
  If those transactions are larger than the wallets remaining funds that can’t happen. Aka wallet A moves coins to wallet B on the old chain and moves all it’s funds into wallet C in the new chain. In that case the A>B transaction is invalid on the new chain.
  - nybble41 7y ago
    That isn't quite how Bitcoin works. Transactions use specific unspent prior transaction outputs (from the "UTxO" set) as inputs; there is no concept of "remaining funds". However, you're mostly right: if the attacker controls the private keys related to the original transaction then they can insert a conflicting transaction and make the original one permanently invalid on that chain. However, an attacker who does not have the private keys to sign a conflicting transaction cannot prevent the transaction from eventually being confirmed unless they control over 50% of the hashpower. If you're concerned that the person you're receiving funds from might be willing to attempt a double-spend then you should wait for a suitable number of confirmations before considering the funds successfully transferred. However, if they control over 50% of the hash rate then there is no suitable number of confirmations that would make the transfer safe.

keymone 7y ago

you're right, 51% represents a certain barrier when the attack becomes much more destructive, but it's still a spectrum. you can destroy faith in the system and value of bitcoin by performing multiple long reorgs with less than 51%.